Apache Commons VFS Information Disclosure Vulnerability

Apache Commons VFS is a public virtual file system from the Apache USA Foundation. Apache Commons VFS prior to version 2.10.0 suffers from an information disclosure vulnerability that stems from the FtpFileObject class that may disclose the original URI containing the password if the file is not...

openSUSE 15 Security Update : apache-commons-vfs2 (SUSE-SU-2025:1022-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1022-1 advisory. - CVE-2025-27553: Fixed possible path traversal issue when using NameScope.DESCENDENT bsc1239973 - CVE-2025-30474: Fixed information disclosure due t...

Apache Commons VFS Path Traversal Vulnerability

Apache Commons VFS is a public virtual file system from the Apache USA Foundation. A path traversal vulnerability exists in Apache Commons VFS versions prior to 2.10.0, which stems from a program's failure to properly filter for special elements in a resource or file path. An attacker could explo...

apache-commons-vfs2-2.10.0-1.1 on GA media (moderate)

apache-commons-vfs2-2.10.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:14929-1 Rating: moderate Cross-References: CVE-2025-27553 CVE-2025-30474 CVSS scores: CVE-2025-27553 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2025-30474 SUSE : 7.5...

The vulnerability of the Apache Commons IO library, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the Apache Commons IO library is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

Security update for apache-commons-vfs2

This update for apache-commons-vfs2 fixes the following issues: CVE-2025-27553: Fixed possible path traversal issue when using NameScope.DESCENDENT bsc1239973 CVE-2025-30474: Fixed information disclosure due to failing to find an FTP file reveal the URI's password in an error message bsc1239974...

SUSE-SU-2025:1022-1 Security update for apache-commons-vfs2

This update for apache-commons-vfs2 fixes the following issues: - CVE-2025-27553: Fixed possible path traversal issue when using NameScope.DESCENDENT bsc1239973 - CVE-2025-30474: Fixed information disclosure due to failing to find an FTP file reveal the URI's password in an error message bsc12399...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

Security Bulletin: Multiple vulnerabilities found on thirdparty libraries used by IBM® MobileFirst Platform

Summary There are multiple vulnerabilities in open source libraries used by IBM MobileFirst Platform Foundation. They are addressed in this update. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not lim...

Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities (CVE-2022-34339, CVE-2021-3712, CVE-2021-3711, CVE-2021-4160, CVE-2021-29425, CVE-2021-3733, CVE-2021-3737, CVE-2022-0391, CVE-2021-43138, CVE-2022-24758)

Summary Security vulnerabilities have been addressed in IBM Cognos Analytics 11.1.7 FP6. These vulnerabilities have also been previously addressed in IBM Cognos Analytics 11.2.3. A vulnerability where user credentials are stored in plain cleartext in a log and could be read by an authenticated us...

OPENSUSE-SU-2025:14929-1 apache-commons-vfs2-2.10.0-1.1 on GA media

These are all security issues fixed in the apache-commons-vfs2-2.10.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2025-27553

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

SUSE CVE-2025-30474

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception messag...

The vulnerability of the resolveFile method in the unified API for accessing various file systems in Apache Commons VFS allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the resolveFile method in the unified API for accessing various file systems using Apache Commons VFS is related to errors in processing the relative path to the directory when handling the scope parameter. Exploiting this vulnerability could allow an attacker to gain...

Exploit for Code Injection in Apache Commons_Text

text4shell-exploit A custom Python-based proof-of-concept PoC...

CVE-2025-27553

A flaw was found in Apache Commons VFS. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains...

CVE-2025-30474

A flaw was found in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password...

GHSA-3936-3GX6-49C4 Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception messag...

GHSA-9Q4X-FR4M-JP86 Apache Commons VFS Has Relative Path Traversal Vulnerability

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception messag...